Add fix-crash-rehlds-security-cvars/en.md
Browse Source
1 changed file
with 111 additions and 0 deletions
fix-crash-rehlds-security-cvars/en.md
A
| @@ -0,0 +1,111 @@ | ||
| 1 | +--- | |
| 2 | +title: "Crash or Mass Kicks After Enabling ReHLDS Security Cvars" | |
| 3 | +excerpt: "Tell a cvar-caused kick, ban or crash apart from an ordinary crash, bisect the batch you just enabled, and keep a ReHLDS hardening baseline that does not punish real players." | |
| 4 | +category: "errors" | |
| 5 | +tags: "rehlds, cvars, crash, kick, security, flood" | |
| 6 | +image: "" | |
| 7 | +read_time: "9 min read" | |
| 8 | +--- | |
| 9 | +<p>You followed the hardening step in <a href="/tutorials/install-rehlds-on-linux">the ReHLDS install guide</a>, restarted, and now the server "crashes": players drop in groups, regulars cannot rejoin, or the process really dies. Usually nothing crashed. The ReHLDS flood limiters kick or IP-ban players by design, a few cvars change what clients receive and break plugins that depend on it, and there is one genuine crash path in the current release. This page was checked against the source of ReHLDS 3.15.0.896, the current release at the time of writing.</p> | |
| 10 | + | |
| 11 | +<h2>1. Crash, kick or ban? Read the console first</h2> | |
| 12 | +<p>Start with timing. If the trouble began with the first restart after the config change, suspect the cvars. If it predates the change or appears every few days at a random map change, treat it as an ordinary crash: see <a href="/tutorials/debug-server-crash-no-error">debugging a crash with no error</a>.</p> | |
| 13 | +<p>Then read the live console (the screen or tmux window, or <code>journalctl -u <your unit></code>). Drop reasons go to the console, not to <code>cstrike/logs/</code>:</p> | |
| 14 | +<pre><code>Dropped PlayerName from server | |
| 15 | +Reason: Banned for string commands flooding (Avg)</code></pre> | |
| 16 | +<p>The limiters print <code>Kicked for</code> or <code>Banned for</code> followed by <code>string commands flooding</code> or <code>move commands flooding</code> with <code>(burst)</code> or <code>(Avg)</code>, or by <code>speedhack</code> / <code>slowmo</code>. "Banned" means ReHLDS ran <code>addip</code> on the player's address, so everyone on that IP now gets <code>You have been banned from this server.</code> <code>listip</code> shows the bans and <code>removeip 1.2.3.4</code> lifts one.</p> | |
| 17 | +<p>Two more lines point at the batch. <code>Too many connect packets from 1.2.3.4:27005 (6>5)</code> in the server log means the per-IP connection limit turned someone away. <code>User 1.2.3.4:27005 will be banned for rcon hacking</code> means the rcon failure cvars caught a client, often your own panel or bot. With <code>developer 1</code> the limiters also print the measured rate, for example <code>PlayerName Banned for string commands flooding (Avg) (312.4)</code>, so you can see how far over the limit a real player went.</p> | |
| 18 | +<p>A real crash is different: the process exits with a segmentation fault and <code>hlds_run</code> restarts it. Only one cvar in this family does that (section 3).</p> | |
| 19 | + | |
| 20 | +<h2>2. Revert the batch, then re-enable one at a time</h2> | |
| 21 | +<p>A cvar keeps its value until something sets it again or the server restarts, so commenting a line out of <code>server.cfg</code> changes nothing on a running server. Check that no other file sets the same cvars:</p> | |
| 22 | +<pre><code>cd /home/steam/hlds/cstrike | |
| 23 | +grep -rn "sv_rehlds_\|sv_rcon_\|sv_filterban" *.cfg addons/amxmodx/configs/</code></pre> | |
| 24 | +<p>Restore the previous config, restart, and confirm the symptom is gone. Then add the cvars back one per restart, treating the four string-rate and the four move-rate cvars as one step each. Wait for a busy evening before calling a step clean: flood limits only trip under real binds, frame rates and packet loss. Typing a cvar name alone shows its live value, for example <code>"sv_rehlds_stringcmdrate_max_avg" is "250"</code>.</p> | |
| 25 | +<p>Add <code>sv_echo_unknown_cmd 1</code> to the top of <code>server.cfg</code> while you work. Without it ReHLDS silently ignores cvars it does not know, and the README on the master branch already lists cvars (<code>sv_rehlds_dlfile_*</code>, <code>sv_reconnect_timeout</code>) that 3.15.0.896 does not have.</p> | |
| 26 | + | |
| 27 | +<h2>3. The cvars that cause trouble, and why</h2> | |
| 28 | +<h3>String and move command flood limits</h3> | |
| 29 | +<p><code>sv_rehlds_stringcmdrate_max_avg</code> / <code>_max_burst</code> limit text commands per second: chat, buy and radio binds, menu choices, and a <code>setinfo</code> each time a userinfo setting (name, <code>rate</code>, <code>cl_updaterate</code>, model) changes. <code>sv_rehlds_movecmdrate_max_avg</code> / <code>_max_burst</code> count movement commands, which a client produces once per rendered frame, so a 1000 fps player sends ten times what a 100 fps player does. Packets lost in transit are added to the move count too, so a player recovering from a lag spike looks like a burst.</p> | |
| 30 | +<p>The defaults compiled into current builds are 250 / 500 for string commands and 1800 / 5500 for move commands. The README still shows older, lower numbers and anti-flood configs often go lower again. Every step below the compiled defaults catches more real players. Bots are never affected: YaPB, PODBot and fake-player plugins are fake clients that send nothing over the network, and the limiters skip them.</p> | |
| 31 | +<p>Two traps in 3.15.0.896 and older:</p> | |
| 32 | +<ul> | |
| 33 | +<li><strong><code>_max_avg 0</code> does not disable the average check.</strong> In these builds the average check is switched off by the <em>burst</em> cvar, so an average limit of 0 bans every player the moment they type anything. To disable a limiter there, set its <code>_max_burst</code> to 0, which turns off both checks. The source has since been changed so each cvar controls its own check; read the release notes of the build you run.</li> | |
| 34 | +<li><strong>Punishment is an IP ban.</strong> <code>sv_rehlds_*_punish</code> is minutes of IP ban, 0 is permanent, negative means kick only. Use -1 while tuning so a false positive costs one reconnect, not a locked-out internet cafe.</li> | |
| 35 | +</ul> | |
| 36 | + | |
| 37 | +<h3>Speedhack detection: the one that really crashes</h3> | |
| 38 | +<p>3.15.0.896 added a speedhack and slow-motion detector (<code>sv_rehlds_movecmdtime_*</code>). Punishment is off by default (<code>sv_rehlds_movecmdtime_max_warnings -1</code>). Set it to 0 or higher and the detector drops the player while their movement commands are still being processed, and in 3.15.0.896 the server can then segfault on the commands left over for that player. The fix landed in the source after that release, so keep it at -1 until your build includes it. Its neighbour <code>sv_rehlds_movecmd_max_null_streak</code> is off by default too; the source notes that legitimate clients above 1000 fps send zero-length commands, so keep it generous if you enable it.</p> | |
| 39 | + | |
| 40 | +<h3>sv_rehlds_maxclients_from_single_ip</h3> | |
| 41 | +<p>Counts connections from one IP that are still connecting (default 5). Lower it and a group behind one address, such as a LAN centre, a household or mobile carrier NAT, gets <code>Too many connect packets from your ip address</code> when joining together.</p> | |
| 42 | + | |
| 43 | +<h3>sv_rehlds_userinfo_transmitted_fields</h3> | |
| 44 | +<p>When set, only the listed userinfo keys reach other clients. The server and plugins still see everything, so nothing errors; it just looks wrong to other players. Leave out <code>\model</code> and plugins that change player models through that key show default models to everyone else. Leave out <code>\*sid</code> and the scoreboard loses Steam avatars. Keep it empty (the default), or start from the README example <code>"\name\model\*sid\*hltv\bottomcolor\topcolor"</code>.</p> | |
| 45 | + | |
| 46 | +<h3>sv_rehlds_local_gametime</h3> | |
| 47 | +<p>This is the one behind most "plugins with hand-built messages break" reports. Each client gets a clock counted from when it connected to the map instead of the map's running time, which the README says reduces the lag that builds up when one map runs for a long time. The engine converts the times it knows about (the clock message, entity time fields, a fixed set of weapon fields). It cannot convert an absolute game time a plugin or custom mod writes into its own message or any other field, so client-side timers, weapon animations or effects fire at the wrong moment. The server does not crash. It is not a security feature, so set it to 0 if anything client-side misbehaves.</p> | |
| 48 | + | |
| 49 | +<h3>The rest of the batch</h3> | |
| 50 | +<ul> | |
| 51 | +<li><code>sv_rehlds_attachedentities_playeranimationspeed_fix</code> stops leg animations speeding up on players with attached entities (hats, back models). The README warns it can cause animation lag at low <code>cl_updaterate</code>. Cosmetic; turn it off if players complain.</li> | |
| 52 | +<li><code>sv_rcon_minfailures</code>, <code>sv_rcon_maxfailures</code> and <code>sv_rcon_minfailuretime</code> ban an address after too many bad rcon passwords, for <code>sv_rcon_banpenalty</code> minutes (default 0, permanent). The usual victim is your own web panel, HLSW or Discord bot with an old password. Because the ban is an IP filter, the tool cannot even query the server and reports it offline.</li> | |
| 53 | +<li><code>sv_filterban</code> must stay exactly 1, its default. That is what makes the IP list a ban list; other values change its meaning and can lock out everyone not on it.</li> | |
| 54 | +<li><code>sv_rehlds_force_dlmax 1</code> (full-size download fragments regardless of the client's <code>cl_dlmax</code>) and <code>sv_rehlds_send_mapcycle 0</code> (already the default) are low risk.</li> | |
| 55 | +</ul> | |
| 56 | + | |
| 57 | +<h2>4. Plugins that trip the limits</h2> | |
| 58 | +<p>If many players are kicked at the same moment, such as round start or spawn, a plugin is pushing commands to clients. Plugins that call <code>client_cmd</code> or build an <code>SVC_STUFFTEXT</code> message by hand make the client run text, and whatever it sends back counts against the string limit, including a <code>setinfo</code> per changed setting. Old rate-enforcer and config-forcing plugins are typical. Find the plugin by commenting out half of <code>plugins.ini</code> at a time, as in <a href="/tutorials/find-crashing-plugin">finding the crashing plugin</a>. Then update it or ask its author to stop pushing settings on every spawn, replace it, or put the limiter back to its compiled default. Do not switch the limits off on a public server for one plugin; at the defaults they only catch abnormal clients.</p> | |
| 59 | + | |
| 60 | +<h2>5. A safe baseline</h2> | |
| 61 | +<p>For 3.15.0.896, in <code>cstrike/server.cfg</code>:</p> | |
| 62 | +<pre><code>sv_filterban 1 | |
| 63 | + | |
| 64 | +// 5 bad rcon passwords in 30 s = 60 minute ban | |
| 65 | +sv_rcon_minfailures 5 | |
| 66 | +sv_rcon_maxfailures 5 | |
| 67 | +sv_rcon_minfailuretime 30 | |
| 68 | +sv_rcon_banpenalty 60 | |
| 69 | + | |
| 70 | +// flood limits at the compiled defaults, kick only while tuning | |
| 71 | +sv_rehlds_stringcmdrate_max_avg 250 | |
| 72 | +sv_rehlds_stringcmdrate_max_burst 500 | |
| 73 | +sv_rehlds_stringcmdrate_avg_punish -1 | |
| 74 | +sv_rehlds_stringcmdrate_burst_punish -1 | |
| 75 | +sv_rehlds_movecmdrate_max_avg 1800 | |
| 76 | +sv_rehlds_movecmdrate_max_burst 5500 | |
| 77 | +sv_rehlds_movecmdrate_avg_punish -1 | |
| 78 | +sv_rehlds_movecmdrate_burst_punish -1 | |
| 79 | + | |
| 80 | +// off until your build has the crash fix | |
| 81 | +sv_rehlds_movecmdtime_max_warnings -1 | |
| 82 | + | |
| 83 | +sv_rehlds_maxclients_from_single_ip 5 | |
| 84 | +sv_rehlds_force_dlmax 1 | |
| 85 | +sv_rehlds_send_mapcycle 0 | |
| 86 | + | |
| 87 | +// behaviour changes: off until you need and have tested them | |
| 88 | +sv_rehlds_local_gametime 0 | |
| 89 | +sv_rehlds_attachedentities_playeranimationspeed_fix 0 | |
| 90 | +sv_rehlds_userinfo_transmitted_fields ""</code></pre> | |
| 91 | +<p>After a week with no false positives you can give the punish cvars a positive ban time. Windows uses the same cvars in the same file; only the engine binary differs (see <a href="/tutorials/install-rehlds-on-windows">ReHLDS on Windows</a>).</p> | |
| 92 | + | |
| 93 | +<h2>Common errors</h2> | |
| 94 | +<ul> | |
| 95 | +<li><strong>Everyone is banned for flooding seconds after joining</strong>: an <code>_max_avg</code> cvar is 0. Restore the default, then clear bans with <code>listip</code> and <code>removeip</code>.</li> | |
| 96 | +<li><strong>High-fps players or players on bad connections get "move commands flooding"</strong>: the move limits are below 1800 / 5500. Restore them.</li> | |
| 97 | +<li><strong>Segfault with players on after enabling speedhack detection</strong>: set <code>sv_rehlds_movecmdtime_max_warnings -1</code>.</li> | |
| 98 | +<li><strong>A group from one place cannot join together</strong>: raise <code>sv_rehlds_maxclients_from_single_ip</code> back to 5 or more.</li> | |
| 99 | +<li><strong>Custom player models look default to others</strong>: add <code>\model</code> to <code>sv_rehlds_userinfo_transmitted_fields</code> or clear it.</li> | |
| 100 | +<li><strong>Your panel or bot shows the server offline</strong>: it was banned for bad rcon passwords. <code>removeip</code> it and update the password; see <a href="/tutorials/rcon-setup-secure">securing rcon</a>.</li> | |
| 101 | +<li><strong>Nobody can connect at all</strong>: <code>sv_filterban</code> is not 1.</li> | |
| 102 | +</ul> | |
| 103 | + | |
| 104 | +<h2>Verification checklist</h2> | |
| 105 | +<ul> | |
| 106 | +<li><code>version</code> prints a <code>ReHLDS version:</code> line, so you know which release's behaviour applies.</li> | |
| 107 | +<li>Each cvar from the batch shows the intended value when typed alone in the console.</li> | |
| 108 | +<li>A full evening of play produces no flood <code>Reason:</code> lines for regular players.</li> | |
| 109 | +<li><code>listip</code> shows no bans you did not expect.</li> | |
| 110 | +<li>Your rcon tools still connect, and the server stays up through several map changes.</li> | |
| 111 | +</ul> | |
| 0 | 112 |
